@ouro.bot/cli 0.1.0-alpha.771 → 0.1.0-alpha.773

package/changelog.json

@@ -1,6 +1,23 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.773",
+      "changes": [
+        "Fail daemon startup closed until configured providers are live and their credentials are cached.",
+        "Surface provider startup failures immediately through a fresh redacted tombstone instead of waiting for a dead daemon or echoing raw logs.",
+        "Recover legacy provider dead letters from current-boot readiness once per generation without per-record alert noise.",
+        "Recover expired managed-runtime leases only after newer runtime liveness, with inspect-before-action turns and bounded batch wakeups."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.772",
+      "changes": [
+        "Make Sanctuary Unraid key rotation crash-resumable with exact transaction and rejection proofs.",
+        "Require durable zero-playback journal evidence before live callback injection.",
+        "Reject malformed Unraid rotation checkpoints before mutation with exact slot, attestation, revocation-order, and phase-state validation."
+      ]
+    },
     {
       "version": "0.1.0-alpha.771",
       "changes": [

package/deploy/unraid/README.txt

@@ -2440,6 +2440,9 @@ Packaged Unit 16 acceptance execution:
   failure. It never reads or changes Unraid autostart configuration. Every command
   also receives a freshly generated, redacted typed container-inspect snapshot;
   raw container environment or credential values are never captured.
+  Callback injection requires two stable zero observations from a durable callback playback journal under
+  `state/approvals`; the journal is keyed only by the full callback-coordinate
+  digest and stores no raw update, callback data, user, chat, message, or query ID.
   Evidence-snapshot keeps the bundle mount read-only and overlays only the exact
   canonical `state/acceptance` directory as writable. It first stops the exact
   healthy staging container under recovery responsibility, then opens the
@@ -2459,17 +2462,40 @@ Audit and safety verification:
   stop and restart mutations; only the separate write key may perform the one
   typed approved restart action.
   The packaged `unraid-key-rotate` command is the only canonical key-rotation
-  authority. It inventories the two occupied canonical names by exact immutable
-  ID, creates collision-safe `Butler RO Rotation <suffix>` and
+  authority. Its host launcher stops the exact production container and assumes
+  trap-backed recovery responsibility before key mutation. It inventories the
+  two occupied canonical names by exact immutable ID, creates collision-safe
+  `Butler RO Rotation <suffix>` and
   `Butler RW Rotation <suffix>` keys, stores and capability-probes both through
-  the Sanctuary machine vault, and requires an exact four-key inventory. It then
+  the Sanctuary machine vault, and on the uninterrupted path requires an exact
+  four-key inventory. Because
+  Unraid 7.2.3 cannot create a role-free key through its CLI, the root broker
+  creates each key as provisional `GUEST` with the intended scope plus only
+  `API_KEY:UPDATE_ANY`, then immediately uses that in-memory credential to
+  self-downgrade the same immutable ID to no roles and the exact intended scope.
+  Disk and live-auth proofs must pass before the credential may reach the vault.
+  The provisional credential never reaches argv, logs, evidence, the bundle, or
+  the model. It then
   revokes both old IDs and proves each old credential receives a 401 or 403.
   Only after an exact inventory contains the temporary pair alone does it create,
   store, and probe the canonical `Butler RO` and `Butler RW` pair. It requires an
-  exact four-key temporary-plus-canonical inventory, revokes and rejection-probes
+  exact four-key temporary-plus-canonical inventory on the uninterrupted path,
+  revokes and rejection-probes
   both temporary IDs, and finally requires exactly the canonical pair. Every
   unexpected key, duplicate, malformed permission set, role, name, inventory
-  delta, or probe response fails closed.
+  delta, or probe response fails closed. A resumed path may observe fewer keys
+  only when the transaction checkpoint plus a durable rejection receipt proves
+  that the missing immutable ID was already revoked; it never treats absence
+  alone as success.
+
+  A failed invocation resumes from the durable redacted transaction checkpoint
+  instead of reminting known keys. The checkpoint binds every created immutable
+  ID to its name, scope, vault field, temporary/canonical class, and attestation
+  state. Recovery reconciles exact live inventory and rejection proofs, skips
+  already-attested vault writes after canonical fields advance, and never
+  recreates a temporary key already known revoked. Root-owned recovery ownership
+  survives broker response loss and is cleared only after the harness has
+  checkpointed the immutable ID and the vault has read back the exact binding.
 
   Record only IDs, names, and permission sets in evidence; never raw key values.
   Raw credentials must not appear in argv, shell history, stdout, logs, or
@@ -2477,7 +2503,9 @@ Audit and safety verification:
   socket in process memory. The narrow revocation-retry recovery records under
   `/mnt/user/appdata/ouro-butler/acceptance/revoked-key-proof` are the sole file
   exception: they are root-owned mode 0600 beneath a root-owned mode 0700
-  directory, excluded from backup/evidence, streamed only on standard input to
-  the bounded rejection probe, retained across failed retries, and durably
-  deleted only after the exact authentication rejection is validated. Never
-  substitute names for IDs when revoking keys.
+  directory, excluded from backup/evidence, and readable only by the root broker.
+  Recovery state is retained across failed retries.
+  Creation intent is fsynced before the CLI side effect so an exact provisional
+  key can be adopted after process death. Raw recovery proof is durably deleted
+  only after the exact authentication rejection and its redacted replayable
+  receipt are fsynced. Never substitute names for IDs when revoking keys.

package/deploy/unraid/sanctuary-acceptance-contract.json

@@ -31,7 +31,7 @@
     "telegram-poller-quiescence": { "operation": "quiesce_telegram_poller", "authority": "fixed-managed-telegram-poller-stop-and-count", "modelReachable": false, "timeoutMs": 15000 },
     "telegram-vault-store": { "operation": "store_telegram_bootstrap", "authority": "fixed-runtime-vault-merge", "modelReachable": false, "timeoutMs": 15000 },
     "cursor-snapshot": { "operation": "snapshot", "authority": "fixed-telegram-state-read", "modelReachable": false, "timeoutMs": 15000 },
-    "callback-live": { "operation": "inject_callbacks_concurrently|inject_callback_replay", "authority": "fixed-live-telegram-callback-probe", "modelReachable": false, "timeoutMs": 15000 },
+    "callback-live": { "operation": "callback_playback_preflight|inject_callbacks_concurrently|inject_callback_replay", "authority": "fixed-live-telegram-callback-probe", "modelReachable": false, "timeoutMs": 15000 },
     "key-inventory": { "operation": "inventory_keys", "authority": "fixed-unraid-key-directory-read", "modelReachable": false, "timeoutMs": 15000 },
     "key-create": { "operation": "create_key", "authority": "fixed-unraid-cli-create-and-vault-store", "modelReachable": false, "timeoutMs": 15000 },
     "key-store": { "operation": "store_key", "authority": "fixed-machine-vault-readback", "modelReachable": false, "timeoutMs": 15000 },

package/deploy/unraid/sanctuary-unit16-host-broker.mjs

@@ -149,27 +149,113 @@ function runUnraid(args) {
   return object(JSON.parse(result.stdout), "Unraid API response")
 }
 
-function createUnraidKey(name, requested, dependencies = { runUnraid, inventoryRecords, persistRecovery }) {
+function permissionObjects(values) {
+  const grouped = new Map()
+  for (const value of values) {
+    const [resource, action] = value.split(":")
+    const actions = grouped.get(resource) ?? []
+    actions.push(action)
+    grouped.set(resource, actions)
+  }
+  return [...grouped.entries()].sort(([left], [right]) => left.localeCompare(right))
+    .map(([resource, actions]) => ({ resource, actions: actions.sort() }))
+}
+
+async function createUnraidKey(name, requested, dependencies = {
+  runUnraid, inventoryRecords, persistRecovery, readRecovery: optionalRecoveryRecord,
+  persistIntent: persistCreateIntent, readIntent: optionalCreateIntent, removeIntent: removeCreateIntent,
+  fetchImpl: fetch,
+}) {
   const before = dependencies.inventoryRecords()
   const beforeIds = new Set(before.map((record) => record.id))
+  const provisionalPermissions = [...requested, "API_KEY:UPDATE_ANY"].sort()
+  let recoveryId = null
+  let cliIdentity = null
   try {
-    const created = object(dependencies.runUnraid(["apikey", "--name", name, "--create", "--permissions", requested.join(","), "--json"]), "created Unraid key")
-    exactKeys(created, ["id", "key", "name"], "created Unraid key")
+    const occupied = before.filter((record) => record.name === name)
+    const existingIntent = dependencies.readIntent?.(name) ?? null
+    if (existingIntent === null) {
+      if (occupied.length !== 0) throw new Error("existing provisional key has no durable creation intent")
+      dependencies.persistIntent(name, provisionalPermissions)
+    } else if (existingIntent.name !== name || JSON.stringify(existingIntent.permissions) !== JSON.stringify(provisionalPermissions)) {
+      throw new Error("Unraid key creation intent is invalid")
+    }
+    let created
+    let provisional
+    let resumed = false
+    let resumedFinal = false
+    if (occupied.length === 1) {
+      provisional = occupied[0]
+      let recovery = dependencies.readRecovery?.(provisional.id) ?? null
+      const provisionalExact = JSON.stringify(flattened(provisional)) === JSON.stringify(provisionalPermissions)
+        && JSON.stringify(provisional.roles) === JSON.stringify(["GUEST"])
+      if (recovery === null && provisionalExact) {
+        dependencies.persistRecovery(provisional)
+        recovery = provisional
+      }
+      if (!recovery || recovery.id !== provisional.id || recovery.name !== provisional.name || recovery.key !== provisional.key
+        || JSON.stringify(flattened(recovery)) !== JSON.stringify(provisionalPermissions)
+        || JSON.stringify(recovery.roles) !== JSON.stringify(["GUEST"])
+        || !(provisionalExact
+          || (JSON.stringify(flattened(provisional)) === JSON.stringify(requested) && provisional.roles.length === 0))) {
+        throw new Error("existing provisional key is not exact owned recovery")
+      }
+      resumedFinal = provisional.roles.length === 0
+      created = { id: provisional.id, key: provisional.key, name: provisional.name }
+      resumed = true
+    } else if (occupied.length === 0) {
+      created = object(dependencies.runUnraid(["apikey", "--name", name, "--create", "--roles", "GUEST", "--permissions", provisionalPermissions.join(","), "--json"]), "created Unraid key")
+      exactKeys(created, ["id", "key", "name"], "created Unraid key")
+      cliIdentity = { id: text(created.id, "created key id", KEY_ID), key: text(created.key, "created key descriptor"), name: created.name }
+    } else {
+      throw new Error("created provisional key name is ambiguous")
+    }
     const id = text(created.id, "created key id", KEY_ID)
     const key = text(created.key, "created key descriptor")
-    if (created.name !== name || beforeIds.has(id)) throw new Error("created key identity is invalid")
-    const matches = dependencies.inventoryRecords().filter((record) => record.id === id)
+    if (created.name !== name || (!resumed && beforeIds.has(id))) throw new Error("created key identity is invalid")
+    const matches = resumed ? [provisional] : dependencies.inventoryRecords().filter((record) => record.id === id)
     if (matches.length !== 1 || matches[0].name !== name || matches[0].key !== key
-      || JSON.stringify(flattened(matches[0])) !== JSON.stringify(requested) || matches[0].roles.length !== 0) {
-      throw new Error("created key record does not match the exact CLI result")
+      || (!resumedFinal && (JSON.stringify(flattened(matches[0])) !== JSON.stringify(provisionalPermissions)
+        || JSON.stringify(matches[0].roles) !== JSON.stringify(["GUEST"])))) {
+      throw new Error("created provisional key record does not match the exact CLI result")
     }
-    return matches[0]
-  } catch (error) {
-    const recoveredIds = new Set()
-    for (const record of dependencies.inventoryRecords().filter((candidate) => !beforeIds.has(candidate.id))) {
-      if (!recoveredIds.has(record.id)) dependencies.persistRecovery(record)
-      recoveredIds.add(record.id)
+    if (!resumed) dependencies.persistRecovery(matches[0])
+    recoveryId = id
+    const headers = { "content-type": "application/json", "x-api-key": key }
+    if (!resumedFinal) try {
+      const updateResponse = await dependencies.fetchImpl(GRAPHQL_ENDPOINT, {
+        method: "POST", headers,
+        body: JSON.stringify({
+          query: "mutation AcceptanceApiKeyDowngrade($input: UpdateApiKeyInput!) { apiKey { update(input: $input) { id name roles permissions { resource actions } } } }",
+          variables: { input: { id, roles: [], permissions: permissionObjects(requested) } },
+        }),
+        signal: AbortSignal.timeout(10_000),
+      })
+      const updateEnvelope = object(await updateResponse.json(), "Unraid key downgrade response")
+      if (!updateResponse.ok || updateEnvelope.errors || !updateEnvelope.data) throw new Error("Unraid key downgrade was rejected")
+    } catch {
+      // A lost response is accepted only when disk and live-auth attestation below prove convergence.
     }
+    const finalized = dependencies.inventoryRecords().filter((record) => record.id === id)
+    if (finalized.length !== 1 || finalized[0].name !== name || finalized[0].key !== key
+      || JSON.stringify(flattened(finalized[0])) !== JSON.stringify(requested) || finalized[0].roles.length !== 0) {
+      throw new Error("created key did not converge to its exact final scope")
+    }
+    const probeResponse = await dependencies.fetchImpl(GRAPHQL_ENDPOINT, {
+      method: "POST", headers,
+      body: JSON.stringify({ query: "query AcceptanceAuthProbe { info { os { hostname } } }", variables: {} }),
+      signal: AbortSignal.timeout(10_000),
+    })
+    const probeEnvelope = object(await probeResponse.json(), "Unraid key readiness response")
+    if (!probeResponse.ok || probeEnvelope.errors || !probeEnvelope.data) throw new Error("created key readiness probe failed")
+    return finalized[0]
+  } catch (error) {
+    const candidates = dependencies.inventoryRecords().filter((record) => record.name === name
+      && !beforeIds.has(record.id)
+      && JSON.stringify(flattened(record)) === JSON.stringify(provisionalPermissions)
+      && JSON.stringify(record.roles) === JSON.stringify(["GUEST"])
+      && (cliIdentity === null || (record.id === cliIdentity.id && record.key === cliIdentity.key && record.name === cliIdentity.name)))
+    if (candidates.length === 1 && candidates[0].id !== recoveryId) dependencies.persistRecovery(candidates[0])
     throw error
   }
 }
@@ -570,27 +656,149 @@ function containerRestartSnapshot(expectedImage) {
 }
 
 function recoveryPath(id) { return `${RECOVERY_ROOT}/${id}.json` }
+function createIntentPath(name) { return `${RECOVERY_ROOT}/create-${createHash("sha256").update(name).digest("hex")}.json` }
+function rejectionReceiptPath(id) { return `${RECOVERY_ROOT}/${id}.rejected.json` }
 
-function persistRecovery(record) {
+function persistPrivateJson(target, value) {
   mkdirSync(RECOVERY_ROOT, { recursive: true, mode: 0o700 })
   chmodSync(RECOVERY_ROOT, 0o700)
   chownSync(RECOVERY_ROOT, 0, 0)
-  const target = recoveryPath(record.id)
   const temporary = `${target}.tmp-${process.pid}`
   const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)
-  try { writeFileSync(fd, `${JSON.stringify(record)}\n`); fsyncSync(fd) } finally { closeSync(fd) }
-  chownSync(temporary, 0, 0)
+  try { chownSync(temporary, 0, 0); writeFileSync(fd, `${JSON.stringify(value)}\n`); fsyncSync(fd) } finally { closeSync(fd) }
   renameSync(temporary, target)
   const directory = openSync(RECOVERY_ROOT, constants.O_RDONLY)
   try { fsyncSync(directory) } finally { closeSync(directory) }
 }
 
+function optionalPrivateJson(target) {
+  try { return object(readPrivateJson(target), "private acceptance record") }
+  catch (error) { if (error?.code === "ENOENT") return null; throw error }
+}
+
+function persistCreateIntent(name, requested) {
+  mkdirSync(RECOVERY_ROOT, { recursive: true, mode: 0o700 })
+  chmodSync(RECOVERY_ROOT, 0o700)
+  chownSync(RECOVERY_ROOT, 0, 0)
+  const target = createIntentPath(name)
+  const fd = openSync(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)
+  try {
+    chownSync(target, 0, 0)
+    writeFileSync(fd, `${JSON.stringify({ schemaVersion: 1, name, permissions: requested })}\n`)
+    fsyncSync(fd)
+  } finally { closeSync(fd) }
+  const directory = openSync(RECOVERY_ROOT, constants.O_RDONLY)
+  try { fsyncSync(directory) } finally { closeSync(directory) }
+}
+
+function optionalCreateIntent(name) {
+  const value = optionalPrivateJson(createIntentPath(name))
+  if (value === null) return null
+  exactKeys(value, ["schemaVersion", "name", "permissions"], "Unraid key creation intent")
+  if (value.schemaVersion !== 1 || value.name !== name) throw new Error("Unraid key creation intent is invalid")
+  return { name, permissions: permissions(value.permissions) }
+}
+
+function removePrivateFile(target) {
+  try { unlinkSync(target) } catch (error) { if (error?.code !== "ENOENT") throw error }
+  const directory = openSync(RECOVERY_ROOT, constants.O_RDONLY)
+  try { fsyncSync(directory) } finally { closeSync(directory) }
+}
+
+function removeCreateIntent(name) { removePrivateFile(createIntentPath(name)) }
+
+function optionalRejectionReceipt(id) {
+  const value = optionalPrivateJson(rejectionReceiptPath(id))
+  if (value === null) return null
+  exactKeys(value, ["schemaVersion", "id", "status", "proofDigest"], "revoked key rejection receipt")
+  if (value.schemaVersion !== 1 || value.id !== id || (value.status !== 401 && value.status !== 403)
+    || value.proofDigest !== createHash("sha256").update(`revoked-key-rejected\0${id}\0${value.status}`).digest("hex")) {
+    throw new Error("revoked key rejection receipt is invalid")
+  }
+  return { valid: false, status: value.status, id }
+}
+
+function persistRejectionReceipt(id, status) {
+  persistPrivateJson(rejectionReceiptPath(id), {
+    schemaVersion: 1, id, status,
+    proofDigest: createHash("sha256").update(`revoked-key-rejected\0${id}\0${status}`).digest("hex"),
+  })
+}
+
+async function probeRevokedUnraidKey(id, dependencies = {
+  readReceipt: optionalRejectionReceipt,
+  readRecovery: optionalRecoveryRecord,
+  persistReceipt: persistRejectionReceipt,
+  removeRecovery,
+  fetchImpl: fetch,
+}) {
+  text(id, "key id", KEY_ID)
+  const receipt = dependencies.readReceipt(id)
+  if (receipt !== null) {
+    const staleRecovery = dependencies.readRecovery(id)
+    if (staleRecovery !== null) {
+      if (staleRecovery.id !== id) throw new Error("recovery key id is invalid")
+      dependencies.removeRecovery(id)
+    }
+    return receipt
+  }
+  const record = dependencies.readRecovery(id)
+  if (record === null || record.id !== id) throw new Error("recovery key id is invalid")
+  const response = await dependencies.fetchImpl(GRAPHQL_ENDPOINT, {
+    method: "POST", headers: { "content-type": "application/json", "x-api-key": record.key },
+    body: JSON.stringify({ query: "query AcceptanceAuthProbe { info { os { hostname } } }", variables: {} }),
+    signal: AbortSignal.timeout(10_000),
+  })
+  if (response.status !== 401 && response.status !== 403) throw new Error("revoked key still authenticates")
+  dependencies.persistReceipt(id, response.status)
+  dependencies.removeRecovery(id)
+  return { valid: false, status: response.status, id }
+}
+
+function optionalRecoveryRecord(id) {
+  try { return normalizeRecord(readPrivateJson(recoveryPath(id))) }
+  catch (error) { if (error?.code === "ENOENT") return null; throw error }
+}
+
+function persistRecovery(record) {
+  persistPrivateJson(recoveryPath(record.id), record)
+}
+
 function removeRecovery(id) {
   unlinkSync(recoveryPath(id))
   const directory = openSync(RECOVERY_ROOT, constants.O_RDONLY)
   try { fsyncSync(directory) } finally { closeSync(directory) }
 }
 
+function acknowledgeStoredUnraidKey(id, dependencies = {
+  readRecovery: optionalRecoveryRecord,
+  inventoryRecords,
+  removeRecovery,
+  removeIntent: removeCreateIntent,
+}) {
+  text(id, "key id", KEY_ID)
+  const matches = dependencies.inventoryRecords().filter((record) => record.id === id)
+  if (matches.length !== 1 || !KEY_NAME.test(matches[0].name)) throw new Error("Unraid key final storage acknowledgement is invalid")
+  const expected = matches[0].name.startsWith("Butler RO") ? RO_PERMISSIONS : [...RO_PERMISSIONS, "DOCKER:UPDATE_ANY"].sort()
+  if (matches[0].roles.length !== 0 || JSON.stringify(flattened(matches[0])) !== JSON.stringify(expected)) {
+    throw new Error("Unraid key final storage acknowledgement is invalid")
+  }
+  const recovery = dependencies.readRecovery(id)
+  if (recovery === null) {
+    dependencies.removeIntent?.(matches[0].name)
+    return { acknowledged: true, id }
+  }
+  const provisional = [...expected, "API_KEY:UPDATE_ANY"].sort()
+  if (recovery.id !== id || recovery.name !== matches[0].name || recovery.key !== matches[0].key
+    || JSON.stringify(recovery.roles) !== JSON.stringify(["GUEST"])
+    || JSON.stringify(flattened(recovery)) !== JSON.stringify(provisional)) {
+    throw new Error("Unraid key recovery ownership is invalid")
+  }
+  dependencies.removeRecovery(id)
+  dependencies.removeIntent?.(matches[0].name)
+  return { acknowledged: true, id }
+}
+
 function permissions(value) {
   if (!Array.isArray(value) || value.length === 0) throw new Error("permissions are invalid")
   const result = value.map((item) => text(item, "permission", PERMISSION)).sort()
@@ -1556,7 +1764,12 @@ async function dispatch(request, dependencies = {
     if (payload.targetServerId !== TARGET_SERVER) throw new Error("target server is invalid")
     const name = text(payload.name, "key name", KEY_NAME)
     const requested = permissions(payload.permissions)
-    return createUnraidKey(name, requested)
+    return await createUnraidKey(name, requested)
+  }
+  if (operation === "acknowledge_key_storage") {
+    exactKeys(payload, ["operation", "targetServerId", "keyId"], operation)
+    if (payload.targetServerId !== TARGET_SERVER) throw new Error("target server is invalid")
+    return acknowledgeStoredUnraidKey(text(payload.keyId, "key id", KEY_ID))
   }
   if (operation === "revoke_key") {
     exactKeys(payload, ["operation", "targetServerId", "keyId"], operation)
@@ -1574,17 +1787,7 @@ async function dispatch(request, dependencies = {
   if (operation === "probe_revoked_key") {
     exactKeys(payload, ["operation", "targetServerId", "keyId"], operation)
     if (payload.targetServerId !== TARGET_SERVER) throw new Error("target server is invalid")
-    const id = text(payload.keyId, "key id", KEY_ID)
-    const record = normalizeRecord(readPrivateJson(recoveryPath(id)))
-    if (record.id !== id) throw new Error("recovery key id is invalid")
-    const response = await fetch(GRAPHQL_ENDPOINT, {
-      method: "POST", headers: { "content-type": "application/json", "x-api-key": record.key },
-      body: JSON.stringify({ query: "query AcceptanceAuthProbe { info { os { hostname } } }", variables: {} }),
-      signal: AbortSignal.timeout(10_000),
-    })
-    if (response.status !== 401 && response.status !== 403) throw new Error("revoked key still authenticates")
-    removeRecovery(id)
-    return { valid: false, status: response.status, id }
+    return await probeRevokedUnraidKey(text(payload.keyId, "key id", KEY_ID))
   }
   if (operation === "request_reboot") {
     exactKeys(payload, ["operation", "targetId", "idempotencyKey", "preflightDigest", "processBindingDigest"], operation)
@@ -1721,7 +1924,11 @@ function writeClosedInventory(file) {
 
 function createBrokerServer(dispatchRequest = dispatch) {
   const dispatchDrain = createDispatchDrain()
+  const connections = new Set()
   const server = createServer({ allowHalfOpen: true }, (connection) => {
+    connections.add(connection)
+    connection.setTimeout(30_000, () => connection.destroy())
+    connection.once("close", () => connections.delete(connection))
     let input = ""
     connection.setEncoding("utf8")
     connection.on("data", (chunk) => {
@@ -1737,7 +1944,8 @@ function createBrokerServer(dispatchRequest = dispatch) {
       } catch { connection.end(`${JSON.stringify({ ok: false, error: "host operation failed" })}\n`) }
     })
   })
-  return { server, dispatchDrain }
+  const destroyConnections = () => { for (const connection of connections) connection.destroy() }
+  return { server, dispatchDrain, destroyConnections }
 }
 
 async function main() {
@@ -1754,7 +1962,7 @@ async function main() {
   const snapshotFd = openSync(initialSnapshot, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)
   try { writeFileSync(snapshotFd, `${JSON.stringify(snapshot)}\n`); fsyncSync(snapshotFd) } finally { closeSync(snapshotFd) }
   chownSync(initialSnapshot, 0, 0)
-  const { server, dispatchDrain } = createBrokerServer()
+  const { server, dispatchDrain, destroyConnections } = createBrokerServer()
   server.listen(socket, () => {
     chownSync(socket, 0, 10001)
     chmodSync(socket, 0o660)
@@ -1764,6 +1972,7 @@ async function main() {
     if (shuttingDown) return
     shuttingDown = true
     server.close()
+    destroyConnections()
     await dispatchDrain.stopAndDrain()
     await interactiveRestartDriver.stopAndDrain()
     let failed = false
@@ -1781,6 +1990,7 @@ if (process.argv[1]?.endsWith("sanctuary-unit16-host-broker.mjs")) {
 }
 
 export {
+  acknowledgeStoredUnraidKey,
   assertStableContainerProcess,
   attestHealthProbeProcessAbsent,
   armRestartAfterResponseClosed,
@@ -1805,6 +2015,7 @@ export {
   observeRebootPreflight,
   parseVaultStatus,
   optionalStoppedContainerExact,
+  probeRevokedUnraidKey,
   queryGraphqlAutostart,
   readBoundedProcStatus,
   driveDuplicateCallbacks,

package/deploy/unraid/sanctuary-unit16-run.sh

@@ -50,9 +50,22 @@ assert_health_probe_cleanup() {
   ' "$ACCEPTANCE_STATE_ROOT" "$BUNDLE_ROOT/state/health/sanctuary-health.json.lease"
 }
 
+terminate_broker() {
+  test -n "$BROKER_PID" || return 0
+  kill "$BROKER_PID" 2>/dev/null || true
+  BROKER_WAIT=0
+  while kill -0 "$BROKER_PID" 2>/dev/null && test "$BROKER_WAIT" -lt 10; do
+    sleep 1
+    BROKER_WAIT=$(( BROKER_WAIT + 1 ))
+  done
+  if kill -0 "$BROKER_PID" 2>/dev/null; then kill -KILL "$BROKER_PID" 2>/dev/null || true; fi
+  wait "$BROKER_PID" 2>/dev/null || true
+  BROKER_PID=
+}
+
 cleanup_unit16() {
   CLEANUP_STATUS=$?
-  if test -n "$BROKER_PID"; then kill "$BROKER_PID" 2>/dev/null || true; wait "$BROKER_PID" 2>/dev/null || true; fi
+  terminate_broker
   if test "$ACCEPTANCE_CANONICAL_PINNED" = yes && ! assert_health_probe_cleanup; then CLEANUP_STATUS=1; fi
   if test "$PRODUCTION_STOPPED" = yes && test "$HOST_REBOOT_COMMIT_STATE" = not_sent; then
     if ! restore_production_container; then CLEANUP_STATUS=1; fi
@@ -73,7 +86,10 @@ cleanup_unit16() {
   if test "$ACCEPTANCE_ALIAS_MOUNTED" = no && test -n "$PRIVATE_ROOT" && test -d "$PRIVATE_ROOT"; then rm -rf -- "$PRIVATE_ROOT"; fi
   return "$CLEANUP_STATUS"
 }
-trap cleanup_unit16 EXIT HUP INT TERM
+trap cleanup_unit16 EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
 
 case "$MODE" in
   materialize)
@@ -347,6 +363,7 @@ cmp -s "$EXPECTED_CONFIG" "$CONFIG_PATH" || exit 1
 case "$COMMAND" in telegram-bootstrap|callback-inject) test -r /proc/self/fd/3 || exit 2 ;; esac
 prepare_live_facts
 if test "$COMMAND" = telegram-bootstrap; then quiesce_production_telegram_poller; fi
+if test "$COMMAND" = unraid-key-rotate; then stop_exact_production_container; fi
 
 case "$COMMAND" in
   telegram-bootstrap) TIME_LIMIT=900; NETWORK=host; INPUT=yes; BUNDLE_MODE=readonly; BROKER=no ;;

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.771",
+  "runtimeVersion": "0.1.0-alpha.773",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-08-30T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>Mendelow Cloud Butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.771</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.773</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/daemon/cli-defaults.js

@@ -77,6 +77,8 @@ const provider_models_1 = require("../provider-models");
 const cli_parse_1 = require("./cli-parse");
 const provider_discovery_1 = require("./provider-discovery");
 const provider_credentials_1 = require("../provider-credentials");
+const startup_tui_1 = require("./startup-tui");
+const daemon_tombstone_1 = require("./daemon-tombstone");
 // ── Default implementations ──
 async function defaultStartDaemonProcess(socketPath) {
     const launchdStarted = await startDaemonProcessViaLaunchd(socketPath);
@@ -724,6 +726,7 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         readHealthState: daemon_health_1.readHealth,
         readHealthUpdatedAt: defaultReadHealthUpdatedAt,
         readRecentDaemonLogLines: defaultReadRecentDaemonLogLines,
+        readDaemonStartupTombstone: daemon_tombstone_1.readDaemonTombstone,
         sleep: defaultSleep,
         spawnBackgroundCli: defaultSpawnBackgroundCli,
         now: () => Date.now(),
@@ -732,6 +735,7 @@ function createDefaultOuroCliDeps(socketPath = socket_client_1.DEFAULT_DAEMON_SO
         startupStabilityWindowMs: 1_500,
         startupTimeoutMs: 60_000,
         startupRetryLimit: 1,
+        isProcessAlive: startup_tui_1.defaultIsProcessAlive,
         listDiscoveredAgents: defaultListDiscoveredAgents,
         runHatchFlow: hatch_flow_1.runHatchFlow,
         promptInput: defaultPromptInput,

package/dist/heart/daemon/cli-exec.js

@@ -113,6 +113,7 @@ const readiness_repair_1 = require("./readiness-repair");
 const human_readiness_1 = require("./human-readiness");
 const human_command_screens_1 = require("./human-command-screens");
 const startup_tui_1 = require("./startup-tui");
+const daemon_bootstrap_startup_1 = require("./daemon-bootstrap-startup");
 const stale_bundle_prune_1 = require("./stale-bundle-prune");
 const up_progress_1 = require("./up-progress");
 const provider_ping_progress_1 = require("./provider-ping-progress");
@@ -1192,6 +1193,7 @@ async function ensureDaemonRunning(deps, options = {}) {
             writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
             /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
             isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+            isProcessAlive: deps.isProcessAlive,
             /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
             now: deps.now ?? (() => Date.now()),
             /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
@@ -1240,6 +1242,7 @@ async function ensureDaemonRunning(deps, options = {}) {
                 writeRaw: deps.writeRaw ?? ((text) => process.stdout.write(text)),
                 /* v8 ignore next -- thin wrapper: real stdout TTY detection injected by default deps @preserve */
                 isTTY: deps.isTTY ?? process.stdout.isTTY === true,
+                isProcessAlive: deps.isProcessAlive,
                 /* v8 ignore next -- thin wrapper: real Date.now fallback injected by default deps @preserve */
                 now: deps.now ?? (() => Date.now()),
                 /* v8 ignore next -- thin wrapper: real setTimeout fallback injected by default deps @preserve */
@@ -1295,7 +1298,9 @@ function formatDaemonStartupFailureMessage(pid, failure, deps) {
     const lines = [
         `background service started (pid ${pid ?? "unknown"}) but did not finish booting: ${failure.reason}`,
     ];
-    const recentLogLines = deps.readRecentDaemonLogLines?.(DEFAULT_DAEMON_STARTUP_LOG_LINES) ?? [];
+    const recentLogLines = failure.includeRecentLogs === false
+        ? []
+        : deps.readRecentDaemonLogLines?.(DEFAULT_DAEMON_STARTUP_LOG_LINES) ?? [];
     if (recentLogLines.length > 0) {
         lines.push("recent daemon logs:");
         lines.push(...recentLogLines.map((line) => `  ${line}`));
@@ -1303,6 +1308,19 @@ function formatDaemonStartupFailureMessage(pid, failure, deps) {
     lines.push("Run `ouro logs` to watch live startup logs or `ouro doctor` for a deeper diagnosis.");
     return lines.join("\n");
 }
+function readFreshDaemonStartupFailure(deps, options) {
+    const tombstone = deps.readDaemonStartupTombstone?.() ?? null;
+    if (!tombstone || (tombstone.reason !== daemon_bootstrap_startup_1.PUBLIC_DAEMON_STARTUP_FAILURE_REASON && tombstone.reason !== "startupFailure"))
+        return null;
+    const timestampMs = Date.parse(tombstone.timestamp);
+    if (!Number.isFinite(timestampMs) || timestampMs < options.bootStartedAtMs)
+        return null;
+    if (options.pid !== null && tombstone.pid !== options.pid)
+        return null;
+    return tombstone.reason === daemon_bootstrap_startup_1.PUBLIC_DAEMON_STARTUP_FAILURE_REASON
+        ? tombstone.message
+        : "background service failed during startup; run `ouro doctor` for diagnosis";
+}
 async function waitForDaemonStartup(deps, options) {
     const now = deps.now ?? Date.now;
     const sleep = deps.sleep ?? defaultSleep;
@@ -1316,6 +1334,16 @@ async function waitForDaemonStartup(deps, options) {
     if (!useHealthMonitor) {
         while (now() < deadline) {
             await sleep(pollIntervalMs);
+            const startupFailure = readFreshDaemonStartupFailure(deps, options);
+            if (startupFailure)
+                return { reason: startupFailure, retryable: false, includeRecentLogs: false };
+            if (options.pid !== null && deps.isProcessAlive && !deps.isProcessAlive(options.pid)) {
+                return {
+                    reason: `${options.serviceLabel} exited before answering`,
+                    retryable: false,
+                    includeRecentLogs: false,
+                };
+            }
             const latestEvent = options.readLatestDaemonEvent?.() ?? null;
             deps.reportDaemonStartupPhase?.(formatDaemonStartupProgressLine(options.serviceLabel, "waiting", latestEvent));
             if (await deps.checkSocketAlive(deps.socketPath))
@@ -1328,8 +1356,18 @@ async function waitForDaemonStartup(deps, options) {
     }
     while (now() < deadline) {
         await sleep(pollIntervalMs);
+        const startupFailure = readFreshDaemonStartupFailure(deps, options);
+        if (startupFailure)
+            return { reason: startupFailure, retryable: false, includeRecentLogs: false };
         const aliveNow = await deps.checkSocketAlive(deps.socketPath);
         if (!aliveNow) {
+            if (options.pid !== null && deps.isProcessAlive && !deps.isProcessAlive(options.pid)) {
+                return {
+                    reason: `${options.serviceLabel} exited before answering`,
+                    retryable: false,
+                    includeRecentLogs: false,
+                };
+            }
             if (sawSocket) {
                 return {
                     reason: `${options.serviceLabel} answered once and then disappeared during startup`,